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DETAILED ACTION 

1. Claims 2-8 and 10 have been examined. 



Claim Rejections - 35 USC §102 

2. The following is a quotation of the appropriate paragraphs of 35 U.S. C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 2 1 (2) of such treaty in the English language. 

3. Claim 2 is rejected under 35 U.S.C. 102(e) as being clearly anticipated by O'Brien et al. 
U.S. Pat. No. 6658571 (hereinafter O'Brien). 

4. As per claim 2 and 10, O'Brien discloses a security method for controlling use of an 
executable application, said method comprising the steps of: procuring a software executable 
policy enforcement agent which, when invoked, imposes one or more conditions on successful 
execution, and which, when successfully executed, invokes execution of said executable 
application (O'Brien: column 2 lines 12-39: software wrapper); encapsulating said executable 
application with said policy enforcement agent without changing said executable application, to 
thereby produce a combined program (O'Brien: column 3 lines 38-55); substituting said 
combined program for said executable application, so that said policy enforcement agent 
executes instead of said executable application program when said executable application is 
invoked (O'Brien: column 2 lines 12-39; column 5 line 56 - column 6 line 16); and one of (a) 
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satisfying said conditions of said control module, whereby said executable application executes, 
and (b) not satisfying said conditions, whereby said executable application does not execute 
(O'Brien: column 6 lines 5-16). O'Brien further discloses wherein said software executable 
policy enforcement agent includes a header component, and said substituting step includes the 
step of amending said header component of said policy enforcement agent portion of said 
combined program to match the characteristics of said combined program (O'Brien: column 2 
lines 12-38: software wrapper is known to change the start-up section so the security module can 
be invoked to process the system call from the software application). 

5. As per claim 10, claim 10 discloses the same scope as that of claim 2. Therefore, claim 
10 is rejected based on the reasons stated in rejecting claim 2. 



Claim Rejections - 35 USC §103 

6. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

7. Claim 3 is rejected under 35 U.S.C. 103(a) as being unpatentable over O'Brien and 
further in view of Kayashima et al. U.S. Pub. No. 20010025346 (hereinafter Kayashima) and 
further in view of Eggebraaten et al. U.S. Pub. No. 20020120776 (hereinafter Eggebraaten). 
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8. As per claim 3, O'Brien discloses a method according to claim 2. O'Brien does not 
explicitly disclose wherein said executable application includes a VPN-tunneling-generating 
application, and said step of satisfying said conditions includes the step of running an antivirus 
program. However, Kayashima discloses running antivirus and firewall and security policy 
procedures to perform security management (Kayashima: [0003]-[0014]). It would have been 
obvious to one having ordinary skill in the art at the time of applicant's invention to run antivirus 
program as security measure to determine whether the application is allowed to execute on the 
computer system. Therefore, it would have been obvious to one having ordinary skill in the art at 
the time of applicant's invention to combine the teachings of Kayashima within the system of 
O'Brien because using anti-virus program to perform security measures is well known in the art. 
O'Brien as modified does not explicitly disclose the executable application includes a VPN- 
tunneling-generating application. However, Eggebraaten discloses VPN software that protect 
data as it flows through VPN tunnel and use of VPN to protect data communicated through 
Internet (Eggebraaten: [0007] and [0031]). It would have been obvious to one having ordinary 
skill in the art at the time of applicant's invention to combine the teachings of Eggebraaten 
within the combination of O'Brien-Kayashima because it protects data while it's being 
communicated/transferred to avoid tampering. 

9. Claim 4 is rejected under 35 U.S.C 103(a) as being unpatentable over O'Brien in view of 
Kayashima and further in view of Eggebraaten and further in view of Wolff et al. U.S. Pub. No. 
20020174358 (hereinafter Wolff). 
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10. As per claim 4, O'Brien discloses a method according to claim 2. O'Brien does not 
explicitly disclose wherein said executable application includes a VPN-tunneling-generating 
application, and said step of satisfying said conditions includes the step of running a antivirus 
program having an acceptable update status. However, Kayashima discloses running antivirus 
and firewall and security policy procedures to perform security management (Kayashima: 
[0003]-[0014]). It would have been obvious to one having ordinary skill in the art at the time of 
applicant's invention to run antivirus program as security measure to determine whether the 
application is allowed to execute on the computer system. Therefore, it would have been obvious 
to one having ordinary skill in the art at the time of applicant's invention to combine the 
teachings of Kayashima within the system of O'Brien because using anti- virus program to 
perform security measures is well known in the art. O'Brien as modified does not explicitly 
disclose the executable application includes a VPN-tunneling-generating application. However, 
Eggebraaten discloses VPN software that protect data as it flows through VPN tunnel and use of 
VPN to protect data communicated through Internet (Eggebraaten: [0007] and [0031]). It would 
have been obvious to one having ordinary skill in the art at the time of applicant's invention to 
combine the teachings of Eggebraaten within the combination of O'Brien- Kayashima because it 
protects data while it's being communicated/transferred to avoid tampering. O'Brien as modified 
does not explicitly disclose running an antivirus having an acceptable update status. However, 
Wolff discloses virus event report that shows update status and it allows virus definition data 
updates to be downloaded by user or as part of a regular scheduled update process (Wolff: [0010] 
and [0033]). It would have been obvious to one having ordinary skill in the art to using antivirus 
program that has acceptable update status to determine the security of data. Therefore, it would 
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have been obvious to one having ordinary skill in the art at the time of applicant's invention to 
combine the teachings of Wolff within the combination of O'Brien-Kayashima-Eggebraaten 
because only using up-to-date antivirus program allows precise security measure. 

1 1 . Claim 5 is rejected under 35 U.S.C. 103(a) as being unpatentable over O'Brien in view of 
Kayashima. 

12. As per claim 5, O'Brien discloses a method according to claim 2. O'Brien does not 
explicitly disclose wherein said step of satisfying aid conditions includes the step of running a 
personal firewall program. However, Kayashima discloses running antivirus and firewall and 
security policy procedures to perform security management (Kayashima: [0003]-[0014]). It 
would have been obvious to one having ordinary skill in the art at the time of applicant's 
invention to run antivirus program as security measure to determine whether the application is 
allowed to execute on the computer system. Therefore, it would have been obvious to one having 
ordinary skill in the art at the time of applicant's invention to combine the teachings of 
Kayashima within the system of O'Brien because using anti-virus program to perform security 
measures is well known in the art. 

13. Claim 6 is rejected under 35 U.S.C. 103(a) as being unpatentable over O'Brien in view of 
Shear et al. U.S. Pat. No. 6292569 (hereinafter Shear). 
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14. As per claim 6, O'Brien as modified discloses a method according to claim 2. O'Brien as 
modified does not explicitly disclose wherein said executable application accepts verification 
information in a format other than a digital certificate, and said step of satisfying said conditions 
includes the step of accepting a digital certificate. However, Shear discloses using certificates 
and digital signatures to protect computer systems from bogus load modules, executables and 
applications (Shear: abstract and column 5 lines 4-50). It would have been obvious to one having 
ordinary skill in the art to check the digital certificate of a program before the wrapper program 
actually invokes the program. It would have been obvious to one having ordinary skill in the art 
at the time of applicant's invention to combine the teachings of Shear within the system of 
O'Brien because digital certificates provide certain trust level to a data so that it can be used to 
determine whether the data is secure or from s secure source. 

15. Claim 7 is rejected under 35 U.S.C. 103(a) as being unpatentable over O'Brien in view of 
Shear and further in view of Atkinson et al. U.S. Pat. No. 6367012 (hereinafter Atkinson). 

16. As per claim 7, O'Brien as modified discloses a method according to claim 6. O'Brien as 
modified does not explicitly disclose wherein said step of accepting a digital certificate includes 
the step of accepting an X.509 based digital certificate. However, Atkinson discloses embedding 
standard X.509 digital certificate within executable file in order to check whether the executable 
file comes from a trusted source (Atkinson: column 2 line 35 - column 3 line 62 and column 7 
lines 10-19). It would have been obvious to one having ordinary skill in the art at the time of 
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applicant's invention to combine the teachings of Atkinson within the combination of O'Brien- 
Shear because X.509 digital certificate is a standard format. 

17. Claim 8 is rejected under 35 U.S.C. 103(a) as being unpatentable over O'Brien in view of 
Shear and further in view of Cooper et al. U.S. Pub. No. 20020029350 (hereinafter Cooper). 

18. As per claim 8, O'Brien as modified discloses a method according to claim 6. O'Brien as 
modified does not explicitly discloses the method comprising the step of translating at least some 
information from said digital certificate into a form recognizable by said executable application. 
However, Cooper discloses most of the major browser programs can recognize digital 
certificates and know where and how to store them (Cooper: [0261]). It would have been obvious 
to one having ordinary skill in the art to use the wrapper program that wraps browser programs 
to recognize the digital certificate and use the digital certificates to determine whether 
software/programs are allowed to execute. Therefore, it would have been obvious to one having 
ordinary skill in the art at the time of applicant's invention to combine the teachings of Cooper 
within the combination of O'Brien-Shear because translating digital certificate so that it can be 
recognized by different programs is well known in the art. 

Response to Arguments 

19. Applicant's arguments filed 1/12/05 have been fully considered but they are not 
persuasive. 
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20. Regarding claim 2, applicant argues that the O'Brien reference does not disclose 
encapsulating the policy enforcement agent without changing said executable application. 
However, O'Brien reference discloses that software wrapper includes security module which is 
invoked to intercept system call from software application (O'Brien: column 2 lines 12-38). 
Therefore, the security module is invoked to change the running parameter according to the 
security policy and no change is made to the application. 

21 . Regarding claim 3, applicant argues that the O'Brien reference is used to limit damage to 
the wrapped commercial software in the event of a successful attack and this presupposition of a 
successful attack presupposes that all defenses, including antivirus software, have failed. 
However, the O'Brien reference discloses a mechanism for dynamically wrapping standards to 
limit the amount of potential damage that a successful attacker or corrupt program can cause. 
O'Brien does not disclose that it presupposes that all defenses have failed because the purpose of 
this mechanism is to limit the amount of potential damage and there is a possibility that the 
mechanism is unable to protect system. Therefore, O'Brien reference does not rely on the 
mechanism as a last resort for defending the system and other protection software applications 
can also be applied to enhance the security of the system (O'Brien: column 3 lines 54-56: 
security module can also be used to enforce other types of policies independent of an 
application). 

22. Regarding claim 4, in response to applicant's arguments against the references 
individually, one cannot show nonobviousness by attacking references individually where the 
rejections are based on combinations of references. See In re Keller, 642 F.2d 413, 208 
USPQ 871 (CCPA 1981); In re Merck & Co., 800 R2d 1091, 231 USPQ 375 (Fed. Cir. 1986). 
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Wolff reference is used to clearly support that antivirus software with acceptable update status is 
well known in the art. 

23. Regarding claims 5-8, In response to applicant's argument that there is no suggestion to 
combine the references, the examiner recognizes that obviousness can only be established by 
combining or modifying the teachings of the prior art to produce the claimed invention where 
there is some teaching, suggestion, or motivation to do so found either in the references 
themselves or in the knowledge generally available to one of ordinary skill in the art. See In re 
Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988)and/n re Jones, 958 F.2d 347, 21 
USPQ2d 1941 (Fed. Cir. 1992). In this case, the O'Brien reference discloses that the security 
module can be used to enforce other security policies independent of application. Therefore, 
other method of protecting computing system can be combined to enhance the security policy. 

24. Regarding claim 10, applicant argues the O'Brien reference does not disclose header or to 
the data location relative to the header. However, O'Brien discloses the invocation of the security 
module is performed instead of the software application and it implicitly discloses the header 
information. Therefore, applicant's argument is respectfully traversed. 

Conclusion 

25. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
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MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Shin-Hon Chen whose telephone number is (571) 272-3789. The 
examiner can normally be reached on Monday through Friday 8:30am to 5:30pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 

Shin-Hon Chen 
Examiner 
Art Unit 2131 
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